Method and apparatus for embedding authentication information within digital data

ABSTRACT

Arbitrary digital information is embedded within a stream of digital data, in a way that avoids detection by a casual observer and that allows a user to determine whether the digital data have been modified from their intended form. The embedded information may only be extracted as authorized and may be used to verify that the original digital data stream has not been modified.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. application Ser. No.09/320,596, filed May 26, 1999, now U.S. Pat. No. 6,163,842, which is acontinuation of U.S. application Ser. No. 09/193,452, filed Nov. 17,1998, now U.S. Pat. No. 6,115,818, which in turn is a continuation ofU.S. application Ser. No. 08/824,174, filed Mar. 26, 1997, now U.S. Pat.No. 5,912,972, which in turn is a continuation of U.S. application Ser.No. 08/357,713, filed Dec. 14, 1994, now U.S. Pat. No. 5,646,997, datedJul. 8, 1997.

BACKGROUND OF THE INVENTION

1. Technical Field

The invention relates to digital data, including digital audio, video,and image data. More particularly, the invention relates to a method andapparatus for embedding authentication data within such digital data ina way that avoids detection by a casual observer and that allows a userto determine whether the digital data have been modified from theirintended form.

2. Description of the Prior Art

The number of applications that use digital storage and transmissiontechniques is increasing at a rapid rate. This technology currently hasa broad range of uses, such as computer manipulation of audio, video andimages; high-quality transmission of video over public networks(including cable and telephone networks);

and permanent storage of archival data, including optically scanned textand images, such as letters and documentation.

Digital data may be modified such that it is not possible to detectwhether the digital data have been modified, without use ofextraordinary means. For example, a photograph may be digitized withhigh-resolution scanning equipment. Once digitized, the photograph maybe modified with any of several different commercial computer programs,and the modified photograph may then be printed with a high-resolutionphotographic printer. It is impossible to detect tampering with thephotographic image by examining the image itself.

Similarly, audio and video recordings are also vulnerable to suchelectronic tampering.

Consider another case: the expanding use of optically scanned images ofdocumentation to maintain an electronic database of business and/orlegal records. For example, many insurance companies are converting toall electronic files. In fact, Federal government regulations now permitthe destruction of paper documentation after conversion to an electronicformat. Such scanned information is often of limited quality and of lowresolution, making tampering a simple task.

The so-called information highway and other increasingly ubiquitouselectronic distribution systems provide fertile grounds in which piracyand electronic tampering can flourish. For example, the Bernieconvention on copyrights gives an artist the right to maintain his workas a single, complete, and unmodified whole. Electronic tampering makesit difficult to ensure and police this property right.

The following definitions are provided for purposes of the discussionherein:

“Authentication” refers to techniques that are used to avoid the problemof electronic tampering and similar problems. The specific effectsauthentication addresses are:

Known Creator. It is important that to know with assurance that theobject originated with the proper source. For example, that a movie camedirectly from the studio.

No Tampering. It is important to have assurance that the object has notbeen modified in some way. For example, it is necessary to know that themovie is the same one paid for, with all portions intact.

Authority to Possess. The receiver of the object should be able to provethat the object was properly obtained (e.g. by licensing or purchase).

Authenticity can be proven either by some feature of the object itself,or by an accompanying object which is known to be authentic. Forexample, a license to use a copy of a software product, usually a paperdocument, typically accompanies the disks containing the software.However, tampering with the object is not easily detected. The softwareon the disks may have been modified, or the license itself may have beenaltered or forged.

Practitioners in communications technologies use the terms “in-band” and“out-of-band” to refer to methods for embedding additional, disguiseddata within the communications channel. In-band information isinformation that is carried within the transmission format itself, whileout-of-band information is information that is carried outside thecommunications channel, e.g. via a second channel. Thus, in-band refersto data encoding that is transparent to underlying transmission andstorage systems, while out-of-band refers to data encoding that isvisible to transmission and storage systems because it must be handleddirectly. Authentication information can be carried either in-band orout-of-band.

An example of out-of-band information relates to the signaling necessaryto set up a phone call between telephone exchanges. This signaling isusually carried on various links that are separate from those links thatcarry the data for the phone connection.

Data overlaid in-band are referred to as embedded data. Varioustelevision transmission systems embed data in-band without changing theformat or viewability of the television signal, for example whenproviding close-captioning, time codes for video editing, and low-speeddata transmission channels for cable converter control and other uses.

Embedded data are sometimes stored in specific fields reserved within adigital data stream. The size and format of these fields does notusually provide sufficient space, security, or reliability to allow thetransmission of sensitive data, such as authentication information. Itis also desirable to avoid changes to existing formats, and to avoidcommitting portions of future formats to always carry certain fields. Itis therefore preferred to allow the embedding of data within a datastream independently of the stream format, such that the both embeddeddata and the original data stream (if desired) can be recovered in areliable and secure fashion.

Embedding additional data in a digital data stream requires modificationof the original data stream. If it is desired to restore the originaldata stream, the portion of the original data stream that was modifiedduring the embedding process must be replaced with the original data.Accordingly, the original data must be embedded in the data stream alongwith the additional data. If high level information about the datastream structure is available, it may be possible to embed theadditional data with less intrusion, such that the additional data areundetectable to the casual observer.

The term “meta-data” refers to information about the data stream, suchas file permission, file type, application type, serial number, creatoridentification, licensee identification, and other arbitrary attributesof the data stream. It is important that meta-data are copied anddistributed in precise tandem with the copying and distribution of thedata stream. Out-of-band systems carry this meta-data as either separateparcels of information, or by reformatting the data stream.

An example of meta-data involves copying a data stream between twocomputer systems. An out-of-band system first copies the meta-data to asuitable file, or stores the information in a relational database.Following this, the original digital data are copied and stored in aseparate file. Because multiple files require a file management scheme,there is a significant likelihood that the data stored in one file donot match the corresponding data in other files. An in-band meta-datasystem only has a single file, representing both the data stream andinformation about the data stream, avoiding the foregoing problemsassociated with out-of-band systems.

One of the most important aspects of meta-data is their use forhigher-level authentication purposes. Ideally, meta-data should bestored as an in-band component of the digital data stream, making thestream simpler to handle and administer. Thus, an out-of-band scheme isnot well suited for this application for at least the following reasons:First, movement of security data must be explicitly handled by theunderlying transmission or storage system, adding cost and complexity tothe system. Second, separate transmission or storage of such securityinformation provides opportunities for unauthorized capture of theinformation, and for aliasing, i.e. where the correct information issuppressed and modified data are provided instead. Third, there is alikelihood of generating errors due to lost or misplaced security data.

In those applications that provide data authentication, a digital datastream must be permanently marked with embedded meta-data, such as aserial number or other identifying information, without altering theunderlying data format. This makes it possible to distribute copies ofthe original data that include indelible authentication information,such that later certification of the copies or detection of unauthorizedcopying is possible.

One industry in which there is a need for such embedded authenticationis the graphics design industry, and in particular companies thatprovide high quality, stock photographic images in digital format foruse in connection with sales collateral and advertisements. Thesecompanies typically charge a royalty for each use of a photographicimage. While the use of electronic distribution for photographic imagesis very attractive, because of its potential to lower distribution andinventory costs significantly, the ability to produce an infinite numberof perfect copies of such images is a big danger to this industry,because there would be little control over distribution. The ability toverify that each copy of a particular photograph is authorized wouldprevent loss of revenue due to unauthorized copying by allowing readyidentification of such unauthorized copies. Accordingly, embeddedauthentication data can provide a way both to detect illegal copying andto prove ownership.

The meta-data embedding process must be secure, otherwise the embeddedinformation can be modified by unauthorized persons in much the same waythat the data stream can be modified. The integrity of the data streammay be secured on several levels, but the most powerful form of suchsecurity only occurs if it is possible to verify that the digital datastream being checked is exactly the same as the original data stream,i.e. that the digital data stream and the authentication informationcarried in the data stream match, indicating that they have not beentampered with.

For this purpose, it is necessary to calculate a compact representationof a digital image from which it is extremely difficult or impossible toreproduce the original. This representation is referred to as a digitalsignature. A suitable algorithm for calculating a digital signaturegenerates a representation that is not reproducible except from theoriginal data. Examples of digital signatures include a checksum, whichis good for small blocks of data; a cyclic redundancy check (CRC), whichprovides a much better signature over larger blocks of data; and a fastFourier transform (FFT), which produces a family of polynomialsdescribing the frequencies in the digital block (essentially, the FFTtransforms data described in the spatial domain to the frequencydomain).

It would be a significant advance in the art of electronic distributionif digital information could be secured against unauthorized use orcopying, for example by providing a tamper proof authentication scheme.

SUMMARY OF THE INVENTION

The invention provides a method and apparatus for basic authenticationof a digital block and for carrying additional authenticationinformation provided by the user, i.e. meta-data, in a secure andreliable fashion. To embed authentication data into a digital block, adigital signature is formed that is a reduced representation of thedigital block. The signature and additional information supplied by theuser are embedded into the digital block by replacing predetermined bitswithin the block. Encryption can be used to enhance authenticationcapability. The encrypted data can be further verified using errorcorrection coding techniques. For sequential data, such as the frames ofa video display, a sequence numbers can also be provided as part of themeta-data to ensure that frames have not been deleted or re-ordered.

During authentication the foregoing steps are reversed, such thatauthentication can be performed only by one having knowledge of theprecise coding procedure. A dedicated logic device can be used toenhance the performance of the foregoing operations.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flow diagram of an embedding sequence according to theinvention;

FIG. 2 is a flow diagram of a retrieval sequence according to theinvention; and

FIG. 3 is a block schematic diagram of an authentication apparatusaccording to the invention.

DETAILED DESCRIPTION OF THE INVENTION

The invention provides an authentication system for digital informationin which data are embedded in a bit stream by modifying an original bitstream. Accordingly, precise reconstruction of the original bit streamrequires the inclusion within the bit stream of an accurate record ofthe bits before modification. Furthermore, the original bit stream mustbe compressible using a reversible technique at a desired compressionratio to provide space within the bit stream for additional information.Alternatively, high-level knowledge of the lossiness of the data (i.e.the information contained in the format is a heavily compressed versionof the original data, such that the original can only be partiallyreconstructed) permits the making of permanent, yet imperceptible,changes to the bit stream.

Transmission systems are rapidly being converted from analog dataformats to digital data formats. The transition from analog to digitaltransmission necessitates the design of new formats for transmission andstorage of the data. Appropriate examples are the Joint PhotographicExperts Group (“JPEG”) format for digital images, and the MotionPictures Experts Group (“MPEG”) format for continuous transmission ofdigitally encoded video data. Both of these formats are lossy, i.e. theinformation contained in the format is a heavily compressed version ofthe original data, such that the original can only be partiallyreconstructed; and both formats take advantage of the fact that humanvisual perception is insensitive to minor errors in the image, makingeven a heavily compressed image acceptable. These standards are readilyadapted for use with the invention. Significantly, the inventionexploits to advantage the fact that the addition of errors to the data,e.g. an image, by modifying the data results in substantiallyimperceptible changes to the data if the number of errors is small.

Certain non-lossy systems are also readily used in connection with theinvention. As discussed above, analog television systems can carryadditional in-band data. Often, these television images begin as digitalvideo data streams. For instance, the Society of Motion Picture andTelevision Engineers (“SMPTE”) 259M standard specifies a digital datastream format for television images that contains considerableinformation about each image. Many in-band data systems, such as timecode, rely on the fact that certain parts of the video image bit streamare not displayed by most television equipment. Adding errors bymodifying a small amount of the data stream does not affect the portionof the image that is presented on the display. In this sense, the videobit stream is lossy because a part of the bit steam may be changedwithout affecting the displayed image.

Although the invention relates to a reversible process that is usefulfor reproducing an original image, it is also useful for authenticatingan image. This concept, often referred to as marking, is analogous tothe serial numbers that are physically placed on most goods. Lossy datastream formats are ideal candidates for marking, both from a technicaland an economic point of view.

An example of marking in the context of the invention herein involvesthe digital archiving of paper documents. By embedding the properinformation in the digital image when the document is optically scanned,it is possible to detect tampering with the document. This allows safedestruction of the paper originals, thereby reducing storage andmaintenance costs. Another use for the invention involves the handlingof legal documents, for similar reasons as those stated above.

The successful implementation of the foregoing applications of theinvention requires a system for checking the authenticity of documentsin a reliable way. Thus, a secure method for distributing theinformation necessary to extract and check the authentication data mustbe provided. Furthermore, such authentication and tamper checkingprocess must be available on demand when the authenticity of a documentis in doubt. For example, by referring to an authentication bureau thatmaintains authentication information at a secure location, using thedocument and a particular authentication method, the bureau can return asimple yes/no authentication without revealing the key. Such a schemehas been proposed by the National Institute of Standards and Technology,but solely for proving a known creator or proper licensee, rather thanfor tamper-proofing.

The invention provides a method and apparatus for authenticating a blockof digital data, such as a video image, a scanned image, or an audiosignal. For the purposes of the discussion herein, these and othersimilar blocks or streams of digital data are referred to as a digitalblock. The invention provides an authentication stamp that is embeddedinto a digital block that contains a digital object. The authenticationstamp modifies the data comprising the digital block. However, theauthentication stamp does not change the basic format of the digitalobject. In most cases, the authentication stamp is obscured relative tothe magnitude of the remaining data. The authentication stamp mayinclude additional data supplied by the user, referred to as meta-data,that are carried in a secure and reliable fashion and that may beretrieved from the digital data block as needed.

In some applications of the invention, the digital data block may berestored to its original state if and only if it is authenticated. Theauthentication methods are typically as secure as the encryption keydistribution scheme and can accommodate minor transcription errors. Theencoding and authentication steps are readily implemented in integrateddigital electronic hardware for dedicated applications, such as cameras,video recorders, and cable converters.

Thus, the invention provides an encoding method that embeds theauthentication stamp in the digital block and a decoding method thatretrieves the meta-data from an authenticated digital block, and allowsrestoration of the original data block, if desired. Both the embeddingand retrieval functions operate upon blocks of data within a datastream. The selection of the size of this block may either beindependent of the data stream format, or it may in some way takeadvantage of the underlying format. Practitioners in the art willrecognize that the block size chosen must satisfy a number of designgoals at the same time, including:

Efficiency: A larger block size usually allows more efficient handlingof the data by either software or hardware. However, larger blocks mayrequire large amounts of memory or other circuitry, thereby raisinghardware cost.

Uniqueness: The block size must be chosen to match the digital signaturetechnique, or vice-versa. The goal is to achieve as unique a signatureas possible, within the bounds of cost and efficiency. For instance, a16-bit checksum is appropriate for very small blocks (e.g. a few tens ofbytes) and is also very quickly calculated, while a Fourier transform isappropriate for very large blocks, but takes a great amount of time tocalculate.

Numbering: It is often desirable to give each digital data block in acontinuous data stream a unique serial number as part of the meta-data.This provides an additional level of tamper proofing, becausere-ordering, addition, or deletion of blocks, as well as modification ofan individual block are readily detected. By matching the block size toa natural size within the format of the underlying data stream, suchnumbering is a very powerful authentication method.

Embedding Process

The embedding process is shown in FIG. 1. A control process invokes theembedding process on an appropriate data block. For each data block, thecontrol process presents a data block and an additional bit string thatmay contain meta-data that is to be embedded along with the basicauthentication information. The meta-data may be a block sequencenumber, and it may also include other meta-data, such as a bit stringthat identifies the creator of the block or the licensing agent. Theembedding process modifies the data block in place to contain theembedded information.

The steps of the embedding process are:

1. Calculate a digital signature for the block (10). The bits modifiedby the embedding process in the digital signature calculation are notincluded because they will change. This is easily done by assuming thatthose modified bits were all zero or all one for the purposes of thecomputation.

2. Append the signature to the meta-data bit string (12). If desired,append to the bit string to be embedded. After appending the digitalsignature, a field indicating the signature calculation technique isused. For more secure applications, this last step should not be done.

3. Compress the original bits and append them to the bit string (14).This step is optional, and only possible if the extracted bits can becompressed at some useful ratio. For example, if 2048 bits in theoriginal image are to be overlaid to carry the embedded data, then a 2:1compression ratio achieved using Lempel-Ziv compression would provideadequate space to carry the compressed data (1024 bits) and leaveanother 1024 bits to carry authentication data.

4. Encrypt the embedded bit string using any useful encryption technique(16), such as the DES encryption standard promoted by the NationalInstitute of Standards, which uses a private-key algorithm to encryptthe data. Greater security may be obtained using the RSA public-keyencryption technique, a patented method in which different keys are usedfor encryption and decryption (see U.S. Pat. No. 4,405,829). If desiredafter encryption, append to the string to be embedded a bit stringindicating the encryption technique employed. For more secureapplications, this last step should not be done.

5. Calculate and append an error correction code to the bit string to beembedded (18). Any suitable technique for producing the error correctioncode (“ECC”) may be used, such as a Single Error Correcting, DoubleError Correcting code (“SECDED”) which uses 8 bits for every 64 bits ofdata.

6. Embed the resulting bit string into the data block (20). For encodingon arbitrary streams, the bit string should be spread out across theblock as much as possible. In some circumstances, a mathematicalfunction for layout might be employed that creates a pseudo-randomdistribution of the bits from the bit string, making it difficult toretrieve the string without intimate knowledge of the function used forembedding. For example, in a SMPTE 259M stream, the least significantbit of a series of luminance values might be modified according to aregular pattern, such as the ratio of the number of bits to be embeddedto the number of luminance values. In a large image, this might meanmodifying only one of every 50 values, which would make the changesinvisible to a viewer of the image.

If the format of the underlying stream is not of importance, and anarbitrary embedding process is chosen, then there is a likelihood thatthe embedding process can obscure formatting information within thestream. This means that the stream cannot be passed to hardware orsoftware that decodes the stream without first recovering the originalstream.

Retrieval Process

The retrieval process is shown in FIG. 2. In this case, the controlprocess presents a data block to the retrieval process along withinformation including the expected error correction code, encryptionalgorithm, and embedding process used. The retrieval process returns acode indicating success or the type of failure, as well as the meta-databit string originally passed in to the embedding process. The retrievalprocess also returns the data block to its original state if overlaidbits were included in a compressed form in the embedded data.

The steps of the retrieval process are:

1. The bit string that was embedded is retrieved from the bit streamusing the inverse of the above described embedding technique (30).Because the data is embedded in-band, it is necessary to know theembedding technique used without reference to the original stream. Theembedded bit string is produced as a result of this step. The data blockis left unmodified. If all other steps succeed, then a final pass ismade that returns the data block to its original form.

2. Use the Error Correction Code in the bit string to correct any errorsthat may have occurred (32).

3. Decrypt the bit string (34). If the less secure method of appending afield to the bit string indicating the encryption technique was used,then decrypt with that method. Otherwise, the decryption method must beknown ahead of time.

4. Extract the digital signature from the bit string (36). Calculate thedigital signature (38) on the supposedly original data block aftersetting all modified bits to a specific value. If the signatures are notthe same (40), then the original image or the embedded bit string hasbeen tampered with. As with the decryption step, if the signature typewas appended to the bit string, extract it and use the information todecide which signature algorithm to apply. Otherwise, the signaturetechnique must be known in advance.

5. Decompress the unmodified bits (44) and restore the block (optional).Extract the compressed representation of the unmodified bits of theoriginal block (42), decompress them, and restore those bits to the datablock (46).

Marking JPEG Images

The JPEG coding algorithm is based in part on the fact that smallsegments of an image are generally similar to nearby segments. Thus,portions of the image can be compressed by taking advantage of thisredundancy. This is done by converting the information in an image fromthe spatial domain into the frequency domain, thereby generating a setof frequency coefficients. Similar portions of the image are nowrepresented by runs of zero coefficients in the frequency domain. Thesezero coefficients may be further compressed by converting thecoefficients into a run-length pair, each pair indicating a number ofzero coefficients and the amplitude of a non-zero coefficient. Thesepairs are then coded with a variable length code, using shorter codesfor commonly occurring pairs and longer codes for less common pairs(Huffman encoding).

A JPEG image may be permanently marked by modifying the leastsignificant bit of a number of the variable length codes in the image.The codes to be modified may be chosen in a number of ways, such as thefirst N codes in each compressed image, or the number of codes in animage divided by the N bits to be embedded. Thus, it is possible to markthe image using the process described herein, such that the marking canbe recovered and verified to be accurate.

A digital signature may be calculated by dividing the image into anumber of fixed size blocks, e.g. 2048-byte blocks. For each block, a32-bit CRC code is calculated. If the compressed image occupies 50kbytes of storage, then the calculation results in 25 blocks. If thesignature is created by concatenating the CRC codes, then an 800-bitsignature is generated.

As an example of marking an image using the invention herein, assume thefollowing:

1) A 196-bit identification key (the meta-data) that includesinformation such as the creator of the image and the final licensee;

2) An 800-bit digital signature; and

3) A 128-bit ECC code.

This is a total of 1124 bits of information. Assume the use ofLempel-Ziv compression to achieve a 2:1 compression ratio of theoriginal bits from the image. This adds an additional 562 bits of datato be embedded, which means that it is also necessary to store thecompressed version of those bits, or another 281 bits, and so on. Thismeans that 2247 bits of information must be embedded in the image. It isalso possible to define a block of data to be embedded, e.g. 2500 bits,and always use that size. This would leave a reasonable amount of roomfor variations in the compression ratio achieved, or for additionalauthentication data.

To achieve an additional level of error correction, each bit can beembedded in triplicate in the image, modifying a total of 6741 bits. Onretrieval, each triplet is extracted, and the resultant bit assumeswhatever value at least two of the extracted bits have in common. Thisprovides a much higher degree of error correction than the embedded ECCcode alone. Out of a 50 kbyte image, this means modifying less than 1.6%of the image, while providing for complete reconstruction of theoriginal image.

Marking An MPEG Digital Movie

The MPEG 1 standard specifies a method of encoding based on estimatedmotion between video frames. A group of pictures (“GOP”) is a sequenceof frames (no more than sixteen) that are encoded together. The firstframe is always compressed using the JPEG algorithm for a single image.Following that, a number of calculations are made to extract informationabout motion between frames. Information about changes between frames isusually much more compact than simply sending succeeding frames, leadingto the high compression rates achieved. For this example, assume thatthe basic block of the invention is an MPEG GOP. For simplicity, thisdescription assumes that only the initial frame of each GOP is to bemarked for authentication.

The meta-data to be encoded in each block is the sequence number of theGOP in the overall sequence of the movie. The authentication informationis embedded within the frame beginning a GOP using the JPEG techniquedescribed above.

On retrieval, the decoder looks for an increasing sequence number afterretrieving the meta-data. If the sequence numbers are not proper, thenthe stream has been tampered with.

Hardware Encoding

It will be apparent to those skilled in the art that this embodiment ofthe invention can be implemented as a software program operating on ageneral purpose computer or microprocessor. However, it is oftendesirable to implement the encoding and/or decoding step in a dedicatedhardware element. FIG. 3 is a block schematic diagram of an integratedcircuit that can be used to embed a sequence number in a series of videoframes.

Preferably, the circuit shown in FIG. 3 is implemented in an integratedcircuit that can process digital video data in real-time, i.e. accept anoriginal video stream and produce a marked video stream. The circuitaccepts digital video in a stream of bytes as specified by the CCIR 601(D1) standard for digital video, in a 4:2:2 format, and produces anequivalent stream including embedded authentication information.

In this format, the image is organized as a sequence of frames, and eachframe is organized as a sequence of scan lines, i.e. rows of pixelsacross the screen. If the video is in the NTSC format, then there are525 lines in each frame, each of which contains the information forabout 656 pixels, encoded as 3 bytes to every two pixels, or 984 bytesper line. In this embodiment of the invention, each frame is marked witha 32-bit sequence number.

In an alternate embodiment of the invention relative to the blockschematic diagram of FIG. 3, each scan line is treated as a data block.Thus, each scan line is marked with a sequence number. Additionally,instead of marking the first scan line with the scan line sequencenumber, the first scan line is instead marked with a frame sequencenumber. The sequence number for each scan line is marked on thesucceeding scan line, with the sequence number for the final scan linebeing discarded.

In this embodiment of the invention, instead of calculating a separateerror correction code, the error correction process forms a portion ofthe embedding/retrieval process. First, for each scan line the circuitcalculates a 32-bit CRC value for the digital signature. Each bit of thesignature is encoded into the least significant bit of the luminance (Y)component of three pixels in sequence. On extraction, these three bitsare compared, and the extracted bit is formed as a match of two or morebits among the three. Accordingly, 96 pixels must be modified. Thesepixels are modified beginning with the first three pixels in the scanline, then another three every 30 pixels.

FIG. 3 shows the control path signal lines as dotted arrows. Data pathlines are shown as solid arrows. The control path of this design isimplemented in a programmable logic device (“PLD”) (300). The PLD iscoupled to control two counters: a frame sequence counter (304) and ascan line sequence counter (303). A simple accumulator with CRC logic(306) is used to calculate the CRC code, which is cleared at thebeginning of every scan line. A simple multiplexor (305) allowsselection of the scan line number or frame number as the bit pattern tobe embedded in the block.

A data input port is coupled to provide the input data of the digitalblock to a three stage pipeline (301). Upon receipt of each pixel, thefirst stage of the pipeline is coupled to provide the pixel to the PLD.The PLD recognizes the code that indicates the beginning of a scan line,and instructs the scan line counter to increment the scan line count. Atthat time, the PLD also instructs the CRC accumulator to send itsresults to the last CRC register (307). If the pixel received isrecognized as the code that indicates the beginning of a new frame, thePLD instructs the bit merger to take the sequence number from the framecounter rather than the scan line counter.

As each pixel passes through the pipeline, the scan line or framesequence number is prepended to the last CRC value, which is merged withthe pixel stream by the bit merger (302) using the technique describedabove, except that the bits are merged starting at a fixed offset afterthe scan line begins, protecting the pixel code that indicates thebeginning of a scan line or frame. Finally, each pixel is coupled to theoutput of the circuit at the third stage of the pipeline, producing aCCIR 601 compliant bit stream.

It should be appreciated that the foregoing applications of theinvention were provided for purposes of example and to teach thepreferred embodiment known at this time. The invention may be used toembed any kind of data, including covert data.

While most prior art is concerned with analog systems, the invention isconcerned strictly with digital embedding. In the analog informationart, an analogous technique is referred to as modulating a signal.Covert analog data are used to modulate a transmitted signal at a verylow rate (i.e. change over seconds or more). Such modulated data arevery hard to detect, but can pass a reasonable amount of informationover so-called covert channels. The dual of this technique in thedigital domain is the novel embedding technique herein described, whichallows a small amount of data to be embedded into a data block bymodifying a small number of bits among very many.

With regard to digital embedding techniques, the prior art is primarilyconcerned with either full-scale encryption or error-free delivery.Thus, the invention may be described generally as:

1. Deliberately introducing errors into a digital data block to embedinformation into the block. The information may be any sequence of bitsthat encode knowledge of interest to the receiver of the data block,such as the authentication information discussed above.

2. By careful choice of where the errors are introduced into the datablock, the errors may be made unnoticeable to the casual observer whenthe data is converted into non-digital forms. These choices depend onthe underlying format and purpose of the data block.

3. With proper knowledge of the error inducing technique, the embeddedinformation can be retrieved on demand.

4. A compressed representation of the modified portions of the datablock may be contained within the embedded information, in which casethe original data block can be recovered by decompressing therepresentation and placing the correct bits into position within theblock.

5. In all cases, any additional errors introduced into the digital datablock after the embedding process are detected, whether these errorshave been deliberately introduced or through failures in the underlyingtransmission or storage systems.

6. When appropriate algorithms are used, it is possible to protect theInformation by either encrypting it or including error correctinginformation within it, or both.

7. The embedded information may include encoding that indicate theencryption technique used.

Although the invention is described herein with reference to thepreferred embodiment, one skilled in the art will readily appreciatethat other applications may be substituted for those set forth hereinwithout departing from the spirit and scope of the present invention.Accordingly, the invention should only be limited by the Claims includedbelow.

What is claimed is:
 1. A method for marking digital image datacomprising the steps of: accepting real time digital image data in theform of a digital data block; producing an equivalent data block to saiddigital data block, said equivalent data block having authenticationinformation embedded therein, at least a part of said authenticationinformation being generated based upon said digital image data and saidauthentication information being embedded in said equivalent data blockin a manner so that said authentication information does not change thebasic format of said digital data block and is not readily detected; anduser determining whether additional modifications have been made to saiddigital data block.
 2. The method of claim 1 wherein said digital datablock is a JPEG image.
 3. The method of claim 2, wherein said step ofproducing includes the step of: modifying the least significant bit of anumber representing a variable length code contained in said JPEG image.4. The method of claim 1, wherein said digital data block is an MPEGimage.
 5. The method of claim 4, wherein said step of producing includesthe steps of: marking a first frame of said MPEG image; and adding asequence number to successive MPEG image frames.
 6. The method of claim4, wherein said step of producing includes the step of: adding asequence number to successive data blocks.
 7. The method of claim 4,wherein said step of producing includes the steps of: marking a firstframe of said PEG image; adding a sequence number to successive MPEGimage frames; and adding a sequence number to successive data blocks. 8.The method of claim 4, wherein said step of producing includes the stepsof: calculating an error correction value for each image scan line;generating a digital signature from said error correction value;encoding said digital signature into a least significant bit of an imageluminance component.
 9. The method of claim 8, wherein said encodingstep is performed on at least three sequential image pixels.
 10. Themethod of claim 9, further includes the steps of: retrieving saidembedded authentication information; and authenticating said image bytesting for a match of at least two of said three image pixels.
 11. Amethod for embedding information into image data representative of animage, comprising the steps of: a) providing image data representativeof an image, said image data comprising digital data blocks includingimage luminance components of the image represented by said image data;b) providing a bit string of information for encoding knowledge ofinterest to a receiver of said digital data blocks, at least a part ofsaid bit string of information being generated based upon said imagedata representative of an image; and c) embedding said bit string ofinformation in said digital data blocks by modifying said imageluminance components with said bit string of information.
 12. The methodof claim 11, further including the step of encrypting said bit string ofinformation to provide an encrypted bit string, and wherein said step ofembedding comprises embedding said encrypted bit string in said digitaldata block by modifying said image luminance components with saidencrypted bit string.
 13. The method of claim 11, wherein said step ofencrypting is performed according to a predetermined encryptiontechnique, and wherein said method further includes the step ofappending digital data indicative of said predetermined encryptiontechnique to said bit string of information.
 14. The method of claim 11,wherein said image luminance components are represented by sequences ofbits representing luminance values for the image, and wherein said stepof embedding comprises modifying said sequences of bits representingluminance values with said bit string of information.
 15. The method ofclaim 14, wherein said step of embedding comprises modifying leastsignificant bits of said sequences of bits representing luminance valuesfor the image.
 16. The method of claim 11, further including the step ofappending meta-data about said image data to said bit string ofinformation.
 17. The method of claim 11, wherein said at least a part ofsaid bit string of information comprises a digital signature generatedbased upon said image data.
 18. The method of claim 17, wherein saiddigital signature is generated based on said image data.
 19. The methodof claim 17, wherein said digital signature is calculated according to apredetermined digital signature calculation technique, and wherein saidmethod further includes the step of appending digital data indicative ofsaid predetermined digital signature calculation technique to said bitstring of information.
 20. The method of claim 11, further including anerror correction step to provide an error correctable bit string whichis embedded in said image data.
 21. The method of claim 20, wherein saiderror correction step comprises calculating an error correction code forsaid bit string for correcting a possible error, and appending saiderror correction code to said bit string.
 22. The method of claim 11,further including the step of compressing said image data.
 23. Themethod of claim 11, further including the step of compressing said bitstring of information.
 24. The method of claim 11, wherein portions ofsaid image data are modified during said embedding step, and whereinsaid method further includes the steps of compressing said portions ofsaid image data that are to be modified during said embedding step toprovide a compressed representation of said portions, and appending saidcompressed representation to said bit string of information.
 25. Themethod of claim 24, further comprising the step of recovering said imagedata after said step of embedding, said step of recovering comprisingextracting said compressed representation from said modified image data;decompressing said compressed representation extracted from saidmodified image data; and replacing the portions of said modified imagedata that were modified during said embedding step with saiddecompressed representation.
 26. The method of claim 11, wherein bitstring includes at least one of restoration information andauthentication information, and wherein said method further includes thesteps of retrieving said bit string from said modified image data, andperforming at least one of a restoring step and an authentication stepon said modified image data in accordance with said retrieved bitstring.
 27. The method of claim 11, wherein said embedding stepcomprises embedding said bit string in a pseudo-random distributionfashion.
 28. The method of claim 11, wherein said image data is a JPEGimage.
 29. The method of claim 11, wherein said image data is an MPEGimage.
 30. The method of claim 11, wherein said image data is providedbased upon optically input information to produce said digital datablocks.
 31. The method of claim 30, wherein said digital data blocks areprovided by a photographic camera.
 32. The method of claim 30, whereinsaid digital data blocks are provided by a video camera.
 33. The methodof claim 11, wherein said image data is provided by one of a camera, avideo recorder, and a cable converter.